Price checked Oct 13, 2026
Review · Security Scanner
Anthropic OSS Scanner
Free, recurring AI security scans for critical open-source projects, from Anthropic’s Frontier Red Team. Reports arrive straight from the model, with no human review.
- Price: Free ($0)
- Paid tier: None
- Who: Core maintainers of eligible OSS projects
- Enroll: Pull request on GitHub
- Launched: Oct 8, 2026
No affiliate link. We are not in any Anthropic OSS Scanner affiliate program, and no link on this page earns us money. This is not a paid placement: Anthropic OSS Scanner did not pay for or review this page. Links to red.anthropic.com are plain links.
Summary
Quick verdict: a genuinely useful free service if you maintain a widely used, security-critical open-source project and can keep up with a stream of high and critical bug reports. Everyone else either won’t qualify or should look at Anthropic’s paid Claude Security instead.
- OSS Scanner is a free, opt-in service from Anthropic that scans open-source code for security vulnerabilities using what it calls “our strongest models.” It launched on October 8, 2026.
- Enrolled projects get periodic scans, and reports are emailed as soon as each scan finishes, skipping Anthropic’s slower human-reviewed disclosure process.
- Each report includes a reproducer, an explanation of the bug and, when available, a suggested patch.
- You enroll by opening a pull request on GitHub with a short project file and a Dockerfile that builds your project offline.
- Eligibility is decided case by case, using OSS-Fuzz-style criteria: the project must have “critical impact on infrastructure and user security.”
- It costs nothing. Anthropic’s commercial code-scanning product for companies is a separate offering, Claude Security.
Watch: Anthropic OSS Scanner in 60 seconds
Made by SaaS Finder Hub from Anthropic OSS Scanner’s public website screenshots. Voiceover is AI-generated. Price at the time of writing this review: free ($0) for eligible open-source projects; there is no paid tier. If you’re reading this at a later date, the price may have changed.
Pricing
Sources: red.anthropic.com/oss-scanner and Anthropic’s launch post, checked October 13, 2026 at about 8:10 AM ET.
| What you get | OSS Scanner |
|---|---|
| Price | Free ($0), “at no cost” |
| Paid plans | None |
| Who can use it | Core maintainers of eligible open-source projects |
| How to join | Pull request to github.com/anthropics/oss-scanner |
| Terms | You accept Anthropic’s OSS Scanner terms when you sign up |
On a phone, swipe the table sideways to see every plan.
Price snapshot: Price at the time of writing this review: free ($0) for eligible open-source projects; there is no paid tier. If you’re reading this at a later date, the price may have changed.
- Anthropic also offers Claude for OSS, which gives maintainers free Claude Max 20x subscriptions to fix what the scanner finds.
- Claude Security, Anthropic’s paid enterprise scanner, is a different product; we didn’t review its pricing.
See Anthropic OSS Scanner pricing
Not an affiliate link. We earn nothing if you sign up.
What free means here (our reading)
- The cost is your time: setting up the project file and Dockerfile, then triaging reports that no human has checked.
- If your project is small or not security-critical, expect not to be accepted.
Price history
| Checked | OSS Scanner |
|---|---|
| Free |
We re-check this page every month and add a row.
Features
From red.anthropic.com/oss-scanner, the launch post and the GitHub repo, October 13, 2026.
- Model-generated reports: no human review or triage before they reach you, so you get them faster.
- What’s in a report: a self-contained reproducer, an explanation, a candidate patch when available and, where possible, when the bug was introduced.
- Recurring scans: Anthropic rescans for new bugs and anything it missed; how often depends on load and how widely your project is used.
- Offline audit: you supply a Dockerfile, and the scan runs without internet access.
- Optional threat_model file: tell the scanner what’s in scope, how to rate severity and how to format patches.
- Encrypted reports: add a PGP key and reports arrive encrypted.
- Easy exit: set disabled: true to pause, or remove your project folder to leave.
- Track record (Anthropic’s numbers): pen testers checked 97 critical and high findings across 48 projects; 85 (88%) met Anthropic’s disclosure bar. wolfSSL said all but two of 74 reports were valid.
Who it’s for
- Core maintainers of widely used open-source projects, especially libraries that handle untrusted input.
- Teams that already keep up with verified high and critical bug reports and want findings sooner.
- Not for you if your code is closed-source (look at Claude Security), your project is a small hobby repo, or you’re already overwhelmed by bug reports.
Related & alternatives
-
Our review
Agent.reviews review
Another new developer tool we reviewed.
-
Our review
Base44 review
Build apps and AI agents by describing them.
-
Our guide
Find the cancel button first
What to check before you sign up for any tool.
The catch
No human checks the reports, and not every project qualifies.
- Anthropic warns reports may be “incorrect or invalid,” and says maintainers have told it severity can be overstated.
- Eligibility is gated and decided case by case, and Anthropic checks that you’re a core maintainer.
- Setup takes real work: a project.yaml file plus a Dockerfile that builds with no internet access.
Verdict
- Enroll if your project is security-critical and you can handle a stream of findings.
- Wait if you’re already behind on bug reports; unreviewed findings will add to the pile.
- Look elsewhere for closed-source code: that’s Claude Security’s job.
Worth it if: you maintain a widely used open-source project and want free, frequent, AI-found security reports with patches.
Skip it if: your code is closed-source, your project is small, or you can’t triage unreviewed reports.
Price at the time of writing this review: free ($0) for eligible open-source projects; there is no paid tier. If you’re reading this at a later date, the price may have changed. Not tested hands-on.
Get the weekly newsletter
One email a week: new tools we reviewed, real prices and the catch. Free, unsubscribe anytime.
Sign-ups are handled by beehiiv. See our Privacy Policy.